Feeds

Spammers unleash DIY phone number slurping web tool

Well it is Valentine's Day... How else are you going to get those digits?

Using blade systems to cut costs and sharpen efficiencies

Mobile spammers have released a DIY phone number harvesting tool, but instead of advertising it solely on criminals-only online hangouts, they're trying to flog it out in the open.

The availability of the utility turns the simple act of submitting a mobile number to a website something that might lead to the receipt of more SMS (text message) spam.

A new version of the phone number harvesting tool crawls the web and indexes mobile numbers, phone ID numbers, the names of the owner, and the associated mobile operator - among other information. Users of the tool can choose which country they want to target.

The harvested information is later used for various malicious and fraudulent purposes.

Key features of the tool include automatic recognition of Russian and Ukrainian mobile phone providers (based on its initial target market), indexing based on a region and city for both Russia and Ukraine, multi-threaded software allowing up to 100 “indexing streams”, as well as an option to collect only numbers attached to a particular mobile provider.

"Cybercriminals and spammers are not strangers to the concept of market segmentation," explained Dancho Danchev, a security researcher at Webroot, in a blog post.

"Just like true marketers, the developer of the tool has included the option to choose a specific region within the available countries, with the idea to assist in the inevitable malicious and fraudulent activity that will result from this phone number harvesting activity."

Danchev advises surfers to double-check whether any website that requests your phone number is actually listing it on the web. The phone number harvesting tool has yet to crawl through sites that require authorisation or spread outside Russia and the Ukraine, he said, but future versions are likely to expanding indexing capabilities and geographical reach, Danchev warned.

The DIY phone number harvesting tool is an example of a wider trend of selling tools that once were exclusively available to sophisticated cybercriminals to less elite cybercrooks though underground forums. Services that offers a means to launch managed SMS flooding and phone ring flooding have recently become available through these forums. Both managed SMS flooding and phone ring flooding are pitched as a means to “take care of your competitor’s phone lines” or a DDoS attack on phones instead of websites. However, these services might easily lend themselves to helping along more ambitious scams, such as flooding out a bank's call centres to prevent early reports of card fraud cash-out operations, according to Webroot.

"By starting to advertise these very same malicious (DIY) tools and services on publicly accessible forums, they’re proving that they’re willing to sacrifice a certain degree of OPSEC (Operational Security) for the sake of growing their business model and attracting new customers," Danchev reports. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.